server: add a schema migration manager for the local state DB

For now this is a functional no-op, it just installs the migrator and hooks it
up when the database is first opened.

go.mod

@@ -8,6 +8,7 @@ require (
 	github.com/klauspost/compress v1.17.7
 	github.com/tailscale/hujson v0.0.0-20221223112325-20486734a56a
 	github.com/tailscale/setec v0.0.0-20240314234648-9da8e7407257
+	github.com/tailscale/squibble v0.0.0-20240320220840-ed9da9df746c
 	honnef.co/go/tools v0.4.7
 	modernc.org/sqlite v1.29.5
 	tailscale.com v1.61.0-pre.0.20240313133645-f12d2557f94a
@@ -41,6 +42,7 @@ require (
 	github.com/cespare/xxhash/v2 v2.2.0 // indirect
 	github.com/coreos/go-iptables v0.7.0 // indirect
 	github.com/coreos/go-systemd/v22 v22.5.0 // indirect
+	github.com/creachadair/mds v0.13.3 // indirect
 	github.com/dblohm7/wingoes v0.0.0-20240123200102-b75a8a7d7eb0 // indirect
 	github.com/digitalocean/go-smbios v0.0.0-20180907143718-390a4f403a8e // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect

go.sum

@@ -60,8 +60,8 @@ github.com/coreos/go-systemd/v22 v22.5.0 h1:RrqgGjYQKalulkV8NGVIfkXQf6YYmOyiJKk8
 github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
 github.com/creachadair/ctrl v0.1.1 h1:sztvK/haLnCSL1IY4mFxEgg5ksAvQMRUFcjB0EeuGY0=
 github.com/creachadair/ctrl v0.1.1/go.mod h1:QORxQsErPqDEuQxtRDa907Chq+IwJUkMAhkHFsphops=
-github.com/creachadair/mds v0.12.2 h1:CyJUaInwFnLUcMgJjVMLG3qYDziSbaY1KXBCvsLrTwQ=
-github.com/creachadair/mds v0.12.2/go.mod h1:4vrFYUzTXMJpMBU+OA292I6IUxKWCCfZkgXg+/kBZMo=
+github.com/creachadair/mds v0.13.3 h1:OqXNRorXKsuvfjor+0ixtrpA4IINApH8zgm23XLlngk=
+github.com/creachadair/mds v0.13.3/go.mod h1:4vrFYUzTXMJpMBU+OA292I6IUxKWCCfZkgXg+/kBZMo=
 github.com/creack/pty v1.1.21 h1:1/QdRyBaHHJP61QkWMXlOIBfsgdDeeKfK8SYVUWJKf0=
 github.com/creack/pty v1.1.21/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -195,6 +195,8 @@ github.com/tailscale/peercred v0.0.0-20240214030740-b535050b2aa4 h1:Gz0rz40FvFVL
 github.com/tailscale/peercred v0.0.0-20240214030740-b535050b2aa4/go.mod h1:phI29ccmHQBc+wvroosENp1IF9195449VDnFDhJ4rJU=
 github.com/tailscale/setec v0.0.0-20240314234648-9da8e7407257 h1:6WsbDYsikRNmmbfZoRoyIEA9tfl0aspPAE0t7nBj2B4=
 github.com/tailscale/setec v0.0.0-20240314234648-9da8e7407257/go.mod h1:hrq01/0LUDZf4mMkcZ7Ovmy33jvCi4RpESpb9kPxV6E=
+github.com/tailscale/squibble v0.0.0-20240320220840-ed9da9df746c h1:KuVHSeCBwIxKURy8VF662341vPMZ0AID4stUeLUVkTs=
+github.com/tailscale/squibble v0.0.0-20240320220840-ed9da9df746c/go.mod h1:L4vAazMfQly5jvYDnytYIVc1ej6OaHw2hGV7ECRfyNw=
 github.com/tailscale/web-client-prebuilt v0.0.0-20240226180453-5db17b287bf1 h1:tdUdyPqJ0C97SJfjB9tW6EylTtreyee9C44de+UBG0g=
 github.com/tailscale/web-client-prebuilt v0.0.0-20240226180453-5db17b287bf1/go.mod h1:agQPE6y6ldqCOui2gkIh7ZMztTkIQKH049tv8siLuNQ=
 github.com/tailscale/wf v0.0.0-20240214030419-6fbb0a674ee6 h1:l10Gi6w9jxvinoiq15g8OToDdASBni4CyJOdHY1Hr8M=

server/tailsql/local.go

@@ -10,12 +10,19 @@ import (
 	"fmt"
 	"sync"
 
+	"github.com/tailscale/squibble"
+
 	_ "embed"
 )
 
 //go:embed state-schema.sql
 var localStateSchema string
 
+// schema is the schema migrator for the local state database.
+var schema = &squibble.Schema{
+	Current: localStateSchema,
+}
+
 // localState represetns a local database used by the service to track optional
 // state information while running.
 type localState struct {
@@ -27,7 +34,7 @@ type localState struct {
 
 // newLocalState constructs a new LocalState helper using the given database.
 func newLocalState(db *sql.DB) (*localState, error) {
-	if _, err := db.Exec(localStateSchema); err != nil {
+	if err := schema.Apply(context.Background(), db); err != nil {
 		db.Close()
 		return nil, fmt.Errorf("initializing schema: %w", err)
 	}

server/tailsql/state-schema.sql

@@ -1,5 +1,4 @@
 -- Local state schema.
-PRAGMA foreign_keys = on;
 
 -- Unique queries by spelling.
 CREATE TABLE IF NOT EXISTS queries (